# Deserializing "Untrusted" Data

**URL:** <https://discourse.julialang.org/t/deserializing-untrusted-data/12621>\
**Category:** General Usage\
**Tags:** question\
**Created:** [July 23, 2018, 11:35pm UTC](https://discourse.julialang.org/t/deserializing-untrusted-data/12621 "2018-07-23T23:35:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![travigd](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/travigd/32/4746_2.png) [@travigd](https://discourse.julialang.org/u/travigd)\
**Post date:** [July 23, 2018, 11:35pm UTC](https://discourse.julialang.org/t/deserializing-untrusted-data/12621/1 "2018-07-23T23:35:34Z")

</div>

How “safe” is deserializing data (à la `deserialize`) from an untrusted source? I’m okay with the process crashing if the data isn’t valid, but **not** okay with arbitrary code execution.

For context, I’m trying to run student code in a sandbox, serialize the result, and then deserialize it to examine and grade it.

---

<div class="post-metadata">

**Author:** ![oxinabox](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/oxinabox/32/206603_2.png) [@oxinabox](https://discourse.julialang.org/u/oxinabox)\
**Post date:** [July 24, 2018, 4:16am UTC](https://discourse.julialang.org/t/deserializing-untrusted-data/12621/2 "2018-07-24T04:16:14Z")

</div>

I lean towards:  
Not safe at all.  
serialization is designed for use for communicating between processes that are designed together, and are part of the same system.  
I believe it has no concern for security.  
I feel like it being able to cause arbitrary code execution during deserialization is potentially required; or at least impossible to stop.  
And certainly stuff like buffer-overflow attacks are quiet possible.

I would suggest using some lowest common demonstrator format for transferring data from a untrusted source.  
Like CSV, JSON, or perhaps BSON or HDF5.